Cybersecurity Basics For Small Businesses

Small businesses are at considerable risk of cyberattack. With fewer staff resources available to maintain and monitor networks and fewer defenses in place, small businesses are an attractive target for hackers and other criminals.

The risks of a cyberattack are considerable. Companies could spend tens of thousands of dollars just to recover from an attack. There’s also the reputational and regulatory downsides if businesses allow data to be compromised, stolen or accessed by unauthorized parties.

To help businesses better understand the risks and solutions, this guide serves as a comprehensive introduction to cyberattacks and how to prevent them.

Defining Cybersecurity and Cyberattacks

Cybersecurity is a collection of preventative measures designed to defend computers, data, mobile devices, servers, networks and users from malicious attacks. Cybersecurity generally focuses on issues that arise from internet-connected devices and systems.

Cyberattacks are criminal activities designed to disrupt networks, prevent access to data, websites and systems, or extract valuable information. Some cybercrime is done solely to wreak havoc on websites and computer systems. Other activities are intentional attacks designed to steal and sell personal information, company secrets or intellectual property. Other cyberattacks are done for geopolitical reasons to disrupt governments, elections or economies.

What Are the Types of Cyberthreats?

Each day, there are new techniques, threats, codes, programs and approaches used to commit cybercrime. Businesses need a firm understanding of what these threat types are in order to choose the right defenses. Below are definitions of the most common threat types.

Malware. Malware is a portmanteau of “malicious” and “software.” It is an umbrella term that covers programs designed to cause harm once installed on a targeted computer or server. Malware includes:

Trojans – Programs that hide a virus or other malicious program. Many “free software” offers trick unsuspecting users into downloading and installing other apps that are actually Trojans.

Adware or Spyware – These programs can take over web browsers and redirect activity to other sites, usually e-commerce pages. These can be difficult to remove and frustrating, as they often use pop-up windows or pages that appear behind another. More nefarious adware can monitor which websites you visit or track keystrokes.

Viruses – Often spread by using removable devices on otherwise clean machines, visiting malicious pages or clicking on email attachments, viruses are designed to damage or destroy files stored on a network.

Worms – A kind of virus that replicates and propagates itself from computer to computer connected to a network. Typically, worms consume computing resources, slowing or stalling your machine.

Advanced Persistent Threats. Most hackers do not break into systems in one fell swoop. Instead, they stage their attack in phases. These advanced persistent threats (APTs), one embedded in a computer, may lie dormant for a period before they are activated. The program may also embed itself differently in different parts of the system, so if one threat is detected and eliminated, others can continue to cause harm.

DDoS. A distributed denial of service happens when outside players overload a server with requests for access or connection. Quickly a DDoS can shut down a target’s networks or websites.

Rootkits. Rootkits are a small piece of software that’s installed by another, larger software program or attacker that’s gained access. While rootkits may not be malicious, they can harbor malicious operations. Using rootkits, an attacker may be able to monitor activity, access information, change programs or use your computer to complete other actions.

Botnets. Botnets are networked, automated programs that can be controlled by one or many outside persons. Botnets are used to spread spam or viruses or to facilitate a DDoS.

Ransomware. A form of malware, ransomware infects your computer system and disables access or functionality, usually to your website. The cybercriminals usually demand a ransom in the form of bitcoin or other difficult-to-trace cyber currency in order to release control of your systems. If the ransom goes unpaid, the hackers usually threaten to release or sell information about your company, customers or employers.

Phishing. Phishing is a common way hackers steal personal information, logins and credit card information. Phishing attacks usually begin with an email urging a user to visit a known website. Once there, a user can unwittingly reveal information that compromises their identity or finances.

Fake Anti-Virus. An unsuspecting user may see an email from their anti-virus provider and install a fake update or upgrade. Instead, the installed software begins to make system modifications (including issuing false threat alerts) that make it difficult to eradicate the program.

Corrupted Files. Even common file types, such as those used for word processing, spreadsheets, images, videos and presentations, can be corrupted by malicious code that’s embedded in a seemingly legitimate file. These programs can execute malicious scripts that consume memory or bandwidth, add or delete files, allow attackers access to your computer or use your computer to attack other machines.

Zero-Day Attacks. When attackers unearth a security flaw or vulnerability in a piece of software before the developers do, it’s an incredible opportunity. Hackers exploit the vulnerability that can extract information or cause damage. The scope of a zero-day attack can be staggering as it can take months or years before the flaw is detected and a corrective patch is built and deployed.

Password Attacks. The more characters and choices your company requires of users when creating passwords, the less likely you’ll be to fall victim to a password attack. A brute-force attack occurs when a hacker uses programs or guesses until they are successful in gaining access. Other attacks include the use of dictionaries to find common words used as passwords and keylogging, which captures keystrokes to steal login IDs and passwords.

Email Spoofing. It is far too easy for hackers to create an email that looks to be from someone, even a known colleague or leader. However, these programs instead are imposters, looking to steal passwords or financial information. A recent series of spoofing emails asked employees at colleges and universities to purchase gift cards for their “colleague,” scratch off the protective coating and send the card authorization codes. If spoofing is used to contact your customers or partners, you may find them leaving to do business with someone else.

Insiders. There’s a good reason to limit the number of employees who have administrative privileges. Inside attacks are often conducted by employees with administrative rights. They use credentials to get access to confidential information and use it for their own benefit or sell it to the highest bidder. Other inside threats manifest themselves when companies fail to remove access rights or user accounts of employees who leave the organization.

Cyberattacks can take many forms: targeting your users, your networks, your devices, your software or your websites. That’s one of the critical reasons why you need cybersecurity solutions that can address all of the potential threats.

Who Commits Cybercrime?

Many people imagine cyberattackers as hoodie-wearing, sunglasses-toting bad guys in their basement inflicting harm for personal gain or “fun.” While there is an element of truth in that stereotype, there are other players in the cyberattack realm. The criminals may be:

47 percent of small businesses had at least one cyberattack in the last year

44 percent had two to four attacks

67 percent of business owners and executives indicated they were concerned or very concerned about cyberthreats

The average cost to a small business for a cyberattack is $34,600

Small businesses incur indirect costs from a cyberattack, including customer loss, difficulty in attracting new customers, brand damage, distraction and productivity loss and staff hours committed to a resolution

Small businesses have other characteristics that contribute to their vulnerability, such as the lack of available budget and qualified personnel to manage the protective measures necessary.

What Kinds of Cybersecurity Tools Are Available?

The number and type of threats are constantly changing. That’s why small businesses need to be vigilant about how to address the potential attacks.

The National Institute of Standards and Technology (NIST) recently released a helpful and clear framework that can help companies understand the layers and purposes of different cybersecurity solutions.

Another way to look at the scope of solutions is to group them into categories based on the type of security they provide. These broad security categories of protective measures collectively provide your business with a comprehensive cybersecurity solution.

The categories and the protections that fall within those groupings are outlined below.

Cyberthreat Assessment. Companies looking to provide blanketed cybersecurity protection should first conduct a thorough assessment of their existing IT infrastructure. Managed IT providers usually begin their engagements with new customers with this deep dive, which provides a baseline understanding of the data, processes and protection in place and the vulnerabilities that need to be corrected.

Security Policies and Practices. There needs to be a collection of well-defined and articulated policies and procedures that address what data is available, what its business function is, how and where it is stored and who can access it. These cybersecurity policies, and the consequences of not following them need to be spelled out for employees, taught and reinforced. Policies should also include the use of personal devices, peripheral devices, home computers, public WiFi and corporate credit cards or purchasing cards.

Access Control. Small businesses should have clear guidelines in place for who determines access to files and servers. Administrative rights should be limited as noted above. Access should be requested and approved using a clearly delineated process that presents clear business reasons for allowing permission. Access should be provided on a need-to-know or need-to-use basis. Access policies should also consider physical access to servers, data centers, data closets, physical media and off-site locations.

Regulatory Mandates. Many industries are subject to government agency or sector-based requirements for the storage and usage of data. These mandates are especially critical to those companies that collect or use personal health information, collect payment information, manage legal documents or do business with certain federal or state entities. Knowing these mandates is critical, as they inform the decisions about what solutions are used and what reporting is required to demonstrate or maintain compliance.

Insurance. Purchasing cyberattack insurance helps to reduce the financial risk of a potential assault. Like with other insurance products, demonstrating the existence of protective measures may result in lower premiums.

Information Security. Ensures data integrity and privacy when information is in transit or at rest.

Data Backup. Backing up your data (and applications and operating systems) is essential to making sure it’s protected and accessible in the event of an attack or natural disaster. Data backups should be done for information stored in the cloud or physical servers. Backup services should use most advanced security measures and best practices, including backing up data in out-of-region locations, automating backup functions and scheduling backups at regular intervals.

Encryption. Encrypting your data while it’s being backed up and when it is stored in the cloud or on-premises makes it that much more difficult for hackers to use the information, even if they can access it.

Wireless Network Security. Protecting your wireless network is an absolute must. Next-generation firewalls secure your network’s perimeter, detecting, containing and destroying unwanted activity before it can cause significant harm. Network security should also include continuous monitoring with automated alerts if suspicious or unusual activity is detected. Wireless network segmentation and segregation can also prevent the co-mingling of use by employees, visitors and web visitors.

Passwords and Authentication. Your small business needs password creation guidelines, multifactor authentication procedures, guest access policies that make it difficult for hackers to break in and access systems.

Application Security. Protects your software applications and the devices that use those apps.

Hardware and Software Updating. Providers regularly distribute updates and patches that address important security issues, fix bugs and remove emergent vulnerabilities. The challenge for small businesses is making sure each connected computer, mobile device and server has the required updates installed. Automated updating is much easier with managed IT services and cloud-based applications and servers.

Mobile Device Security. Mobile devices enable employees to access information and networks from anywhere and at any time. However, mobile devices are especially vulnerable, especially when employees are required to provide their own equipment. For example, employees may not install the necessary updates, access information on unsecured public WiFi networks, or have devices stolen or lost.

Business Continuity and Disaster Recovery. Plans and policies to recover from a cyberattack and ensure business operations are up and running with little to no downtime.

Business continuity is the overarching guidance, policies, methods and protocols that ensure that a business can continue operations during and after a natural or manmade event. Disaster recovery is a subset of business continuity, focused on the procedures used to restore systems, access data backups and deal with the incident at hand.

End-User Education. Training and awareness programs for employees and other users.

In many ways, education and awareness are the first lines of cyberdefense. Employees need to understand the scope of cyberthreats, how those threats appear and what they can do to defend themselves and the organization.

Cybersecurity is an absolute must for small businesses today. Knowing the types of attacks and the available solutions is the best defense against criminals looking to do harm.

“My passion for quality IT service is at the forefront of my career.”

Lance Skipper Client Engineer

Matthew Morman

Always at your service to provide the highest level of quality support to our customers.

Anthony Firth Client Engineer

“I’m passionate about building and fostering relationships, and finding solutions for success.”

Michael Koenig Client Account Manager

“Enabling IT to become an effective and valuable partner by delivering premier customer service and quality IT solutions achieving business goals.”

Jake Parrott Business Development Manager

“Serving the client through IT solutions is my passion. A happy client is a happy me.”

Jason RichardsonClient Engineer

“Striving to provide friendly and quality service to our customers”

Ted Rorabaugh Client Engineer

“I help clients stabilize and grow their IT infrastructure so they can focus on growing their core business.”

Josh Wilshire Systems Engineer Team Lead

“Providing courteous, quality IT service for our customers.”

Rich Yoest Rapid Response Team Supervisor

“Striving to be your trusted adviser and IT teammate in accomplishing all your business goals”

Brandan Bishop Client Account Manager

“I strive to provide the highest level of quality service to our customers.”

Tommy Williams Sr. Hardware Engineer

“I’m driven by the steadfast belief that technology must serve as a business enabler. This mantra has driven 21
Years of successful partnerships.”

Stephen Riddick VP Sales & Marketing

“CSP doesn’t succeed unless your company succeeds.”

Stephen Allen Inventory Manager

“Through my intuition and genuine concern to help others I have built long-lasting relationships with our customers, co-workers and business partners.”

Scott Forbes VP Support Services

“Every day, I work with clients to help plan the future of their businesses.”

Michael Bowman vCIO

“Your IT problems become our IT solutions.”

Mark McLemore Project Engineer

“Managing internal and external operations to ensure that CSP provides quality and reliable customer service .”

Margie Figueroa Business Manager

“Helping customers get the most out of their IT Infrastructure.”

Marc Gillet Project Engineer

“Providing quality internal and externals financial support to our customers and accounting support to CSP.”

Katie Steiglitz Accounting Administrator

“Your satisfaction is our #1 priority.”

Heather Moore Project Manager

“Some call me the CEO. I call myself the Cheerleader for an awesome team!”